CVE-2026-104828

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104828
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104828.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104828
Aliases
  • GHSA-39xg-prhf-8785
Published
2026-10-15T18:36:49Z
Modified
2026-10-17T02:47:54Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
Details

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104828.json"
}
References

Affected packages

Git / github.com/htmlunit/htmlunit-neko

Affected ranges

Type
GIT
Repo
https://github.com/htmlunit/htmlunit-neko
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c165891e0753aef3e05f5daa6250d3e8d4ada3c0
Fixed
8a6d4f9e2eede739b2decc9dabf17b702bc6713d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.4.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.34.0
2.*
2.32
2.33
2.35.0
2.36.0
2.37.0
2.38.0
2.39.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.47.1
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
2.53.0
2.54.0
2.55.0
2.56.0
2.57.0
2.58.0
2.59.0
2.60.0
2.61.0
2.62.0
2.63.0
2.64.0
2.65.0
2.66.0
2.67.0
2.68.0
2.69.0
2.70.0
3.*
3.0.0
3.1.0
3.10.0
3.11.0
3.11.1
3.11.2
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
4.*
4.0.0
4.1.0
4.10.0
4.11.0
4.12.0
4.13.0
4.14.0
4.15.0
4.16.0
4.17.0
4.18.0
4.19.0
4.2.0
4.2.1
4.20.0
4.20.1
4.21.0
4.3.0
4.4.0
4.5.0
4.6.0
4.7.0
4.8.0
4.9.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104828.json"